If you were wary of a message from Facebook about your profile
security levels being low, you’re not alone.
Considering the recent rash of profile hack-ins and password
breaches, many Facebook users are thinking before clicking these
days.
And with good reason: hackers have been able to access thousands of
profiles this year either due to user error or other sites’
negligence (see: Gawker’s massive
password snafu from two weeks ago).
But this message, appearing on profiles everywhere, despite looking
similar to fake anti-virus and phishing virus pop-ups, is actually
from Facebook.
According to the social networking site, many (if not all) profiles
have low or “very low” account protection statuses --
even the profiles run by very tech-savvy users.
Solution?
Facebook’s apparent solution to this problem is what
leaves some Internet security experts scratching their heads. Is it
making your password harder to guess? Or disabling rogue
applications?
Nope. It’s giving Facebook more of your personal
information.
Once the note’s “increase protection” link is
clicked, Facebook asks for an additional email address; a different
one than was used to create the profile.
“Facebook's thinking is that if you lose control of the, say,
Hotmail or Gmail account that you normally log into the site with,
you'll be able to regain access to your Facebook account by giving
them an alternative email address. They could then use this, for
instance, to communicate with you,” said Graham Cluely,
senior technology consultant at Sophos.com.
Which is all well and good, but Cluely wonders if Facebook’s
intentions are not purely security-related.
Where does it go?
Along with the obvious issue of people who use the same password
for their email accounts and their Facebook profile (don’t,
by the way), Cluely points out Facebook makes no mention of what
else, exactly, they possibly plan to do with users’ alternate
email addresses.
“Not only would you be right to be concerned about whether
you are increasing the potential for data loss by sharing
alternative email addresses with online companies, but is it
possible that Facebook might also use this secondary email address
to further interconnect you with possible contacts?” said
Cluely.
While Cluely points out Facebook has good intentions, attempting to
cull data from users to help them regain control of compromised
profiles, the company is going about it in a curious way. They also
want your phone number.
Along with another email address, Facebook claims your profile
security will be beefed up if you provide your cell phone number
(for those users who haven’t already).
Facebook is possibly asking for this so users will be able to
utilize the new “one-time password” feature they
announced plans for in October 2010.
For users whose profiles have been compromised, they can receive a
one-time temporary password to access their account via text --
only if Facebook has the mobile phone number on file, of
course.
Unanswered questions
Again, all well and good, but Cluely brings up some interesting,
real life problems with this “security fix.”
“What happens if you lose your mobile phone, or someone else
briefly swipes it from your jacket pocket? Then an unauthorized
individual -- whether they be a potential identity thief or a
jealous partner -- could potentially access your account via the
system,” he said.
Plus, if Facebook has your cell phone number on hand, what else are
they planning to do with it?
Lastly, Facebook wants you to pick one of their “security
questions” and provide an answer only you would know. This
would also act like a password in a pinch. But again, Cluely points
out the flaw in Facebook’s plan.
The questions, including “In what city or town was your
mother born?” and “What was the first name of the first
boy or girl you ever kissed?” are ones whose answers could,
relatively easily, be guessed based on… wait for it…
information culled from people’s profiles.
“Where's the advice from Facebook that you shouldn't answer
these questions honestly? Where's the option to write your own
question?” wonders Cluely.
While Facebook appears concerned about profile security, many users
are unhappy with the way, intentional or not, they‘re
presenting the issue.
“The suggestion that users' accounts currently have a
protection status of ‘very low’ is entirely misleading
and stinks of scare tactics,” said Cluely.
Simple fixes
For users who don’t want to provide additional information to
Facebook, but are still concerned about keeping their profiles
safe, there are some simple fixes:
- Choose a Facebook password that is completely different from all your other passwords. Mixing upper-and lower-case letters along with a few numbers is always a safe bet. If you’re scared about forgetting it, write it down and keep it in a safe place.
- Log out of your account every time you’re finished with it. Even if you think you’re the only one using that computer or handheld device.
- Don’t use the word “password.” Seriously.
